ES2159274T3 - CALCULATION PROCEDURE TO CRYPTTOGRAPH AN ELIPTICAL CURVE. - Google Patents

Abstract

Cryptography procedure implemented between two entities that exchange information through an unsecured communication channel, of the type that includes, at least, an operational phase consisting of multiplying an odd point of order of a non-supersingular elliptic curve by an integer , characterized in that, in order to exchange information through the non-secure communication channel, said operational phase comprises additions and divisions by two points of said elliptic curve, where the addition of points is a known operation and the division by two of a point P is defined as the single point D of odd order such that [2] D = P, said point being represented by [1 /] P, and the operation of division by 2: [1/2].

Description

Calculation procedure to cryptograph a elliptical curve

The invention relates to a method of cryptography implemented between two entities that exchange information through a communication channel not protected, for example, a wired network, or hertzian, and that allows ensure the confidentiality and integrity of transfers of information between these two entities. The invention relates, more particularly, to a refinement of the systems of Cryptography that puts calculations into an elliptical curve. The improvement allows, mainly, to reduce the times Calculation

A cryptography protocol is known, used, more particularly, to perform an exchange of Protected keys between two entities. This one is known with the denomination of "Exchange of Keys of Diffie-Hellmann "or" ECDH ". Its setting in practice needs the use of a group in the sense term mathematician. An elliptical curve of the type:

y 2 + xy = x 3 +? x2 + \beta

it can constitute a usable group in a procedure of this kind.

It is known that if P = (x, y) belongs to the curve elliptical E, you can define a "product" or "multiplication scale "from point P of E by an integer m. This operation is define as follows:

[m] \ P = P + P + P + ... + P \ (m \ times)

It is known that in an "ECDH" type algorithm, the multiplication by 2 of a point P chosen from a elliptical curve of this type. This operation is called "point bending" and is part of an iterative process of  bending-and-adding. A multiplication by 2 of this type requires time.

The slowest part of the Exchange protocol of Keys of Diffie-Hellmann (ECDH) is the multiplication of a curve point not known in advance by a random scalar. Only curves are considered here ellipticals defined in a body of characteristic 2; this is one extended choice for implementations, because the addition in such a body corresponds to the operation "or exclusive".

It is known that multiplication by a scalar can be accelerated in the curves defined in a low body cardinality using the morphism of Frobenius. Can be chosen the curves so that none of the known attacks apply to they. However, it is preferable, if any, at least in the plane of the principle, to be able to choose the curve you want to use in a class of curves as general as possible. The method described in the invention applies, in its fastest version, to the half of the elliptical curves. Also, from a point of view Cryptographic, this method is the best. Before giving the beginning of the method, the basics are remembered.

As an illustration simply, the curve is taken Elliptical (E) geometrically representable in the set R of the real numbers by the equation y2 + + = x3 - x 2, represented in Figure 1 in which a horizontal line represents an integer m, a vertical line represents a integer n and each intersection of such horizontal lines and vertical represents the pair of integer coordinates (m, n).

(E) goes through a finite number of points of whole coordinates, and any secant to (E) coming from a point of this type cuts to (E) in 2 points, eventually confused (case of the tangents to the curve).

The addition operation between any two of these points A and B are defined as follows: let B_ {1} be the point where the line (AB) cuts to (E); the vertical of B_ {1} cut to (E) at C = A + B.

In the particular case where (AB ') is tangent to (E), C 'is the sum sought.

Point O, "intersection of all vertical, "is called the point at the infinity of (E) and is the neutral element of the addition so defined, since applying the geometric construction of definition of the addition, you have: A + O = O + A = A.

The doubling of A, indicated by [2] A is defined as: A + A, is therefore the point B ', being the line (Ax) tangent in A to (E).

Applying to point B 'the addition construction of A, point [3] A and so on would be obtained: this is the product definition [n] A of a point by a whole.

The present invention relates, in fact, to a family of elliptical curves, not geometrically representable, but defined as follows:

Let n be a given integer, F_ {2} {n} the body of 2 ^ n elements, and \ overline {F} 2 n, its algebraic closure. Let O be the point at infinity. It is called elliptic curve E no supersingular defined in F_ {2 ^ {n}}, the set:

E = {(x, y) \ in F_ {2 ^ {\ ddot {n}} x F_ {2 ^ {\ ddot {n}}} ly2 + xy = x3 +? x2 + \ beta} \ cup {O} \ alpha, \ beta \ in F_ {2}, \ beta \ neq 0

The elements of E are usually called "points". It is well known that E may be endowed with a abelian group structure taking the point at infinity as neutral element. In what follows, the finite subgroup is considered of the rational points of E, defined by:

E (F_2n) = {(x, y) \ in F_ {2} n X F_ {2 ^ {n}} ly2 + xy = x3 + α x 2 + \ beta} \ cup {O} \ alpha, \ beta \ in F_ {2}, \ beta \ neq 0

N being the set of natural integers, for any m \ in N, the application is defined in E "multiplication by m" by:

[m]: E \ rightarrow AND

P \ rightarrow P + ..... + P \ (m \ times) \ y \ \ forall P \ in E: [O] P = OR

E [m] indicates the core of this application. The points of group E [m] are called the torsion points m of E. The group structure of the torsion points m is fine known.

Limiting itself to the case where m is a power of 2, you have:

\ forall k \ in N: E [2k] \ cong Z / 2k Z

where Z is the set of integers relative.

Since E (F_ {n}}) is a finite subgroup of E, there is k '? 1 such that E [2k] is contained in E (F_ {n}}) if, and only if, k \ leq k '. Limited to elliptic curves E for which k '= 1, the structure of E (F 2 n) is:

E (F_ {n}}) = G \ x \ \ {Or, T_ {2} \}

where G is an odd order group and T_ {2} designates the single point of order 2 of E. It is said that a curve of this guy has a twist 2 minimum

You are now able to apply the object of the invention. Multiplication by two is not injective when it is defined in E or E (F_ {2 ^ {n}}), because it has per core: E [2] = {O, T_ {2}).

On the other hand, if the scope of the invention of multiplication by 2 to an odd order subgroup G  \ subset E (F_ {2 ^ {n}}), multiplication by 2 is done Bijective

It turns out, thus, that multiplication by 2 admits in this subgroup an inverse application that will be called division For 2:

[1/2]: G \ rightarrow G

P \ rightarrow Q \ such \ that: [2] Q = P

[1/2] P indicates the point of G at which the bending application corresponds to the point P.

For any k \ geq 1, it is written:

\ left [\ frac {1} {2 ^ {k}} \ right] = \ left [\ frac {1} {2} \ right] or \ left [\ frac {1} {2} \ right] or . ........ o \ left [\ frac {1} {2} \ right]

To represent k application compositions of division by 2 with himself.

In general, the invention relates, by therefore, to a cryptography procedure implemented between two entities that exchange information through a unprotected communication channel, of the type comprising, at less, an operational phase consisting of multiplying a point of odd order of an elliptic curve not supersingular for an integer, in related coordinates, characterized in that an operational phase of This type includes additions and divisions by two points of the cited elliptic curve; where the addition of points is an operation known, and the division by two of a point P is defined as the single point D of odd order such that [2] D = P, being indicated such a point by

\ left [\ frac {1} {2} \ right] P

and the division operation by 2, by:

\ left [\ frac {1} {2} \ right]

The application of division by 2 is interesting for the scalar multiplication of a point of an elliptic curve for the following reason: if you work in related coordinates, it is possible to replace all point multiplications by 2 of a scalar multiplication by point divisions by 2.

The division by 2 of a point is much faster of calculating that its multiplication by 2. From a point of view cryptographic, it is good to have to choose between the largest number of possible curves, and it is customary to use a curve in the which torsion 2 of E (F 2 n) is minimal or isomorphic in Z / 4Z. For a given body F 2 n, the elliptic curves of minimum twist 2 constitute exactly half of the set of elliptic curves defined in F 2 n. For this reason, although the described method is not totally general, it is applied, in its faster version, to a large part of the interesting curves in cryptography. This is always applicable in the case where Body elements are represented on a normal basis. In the In the case of a polynomial base, the required memory space is order of O (n2) bits.

Next, there are some examples, referring to the attached drawings, in which:

- Figure 1 is a graph illustrating a curve very particular elliptic but geometrically representable, that allows to clarify the elementary operations implemented in the framework of the invention, having explained previously these operations;

- Figure 2 is a diagram illustrating information exchanges according to the invention, between two entities;

- Figures 3 to 6 are organizational charts that explain some applications according to the invention; Y

- Figure 7 is a block diagram of another information exchange scheme between two entities A and B, liable to implement a cryptography process of according to the invention.

It will show how to calculate [1/2] P \ in G from P \ in G. Next, it will show how to replace the point doubling by divisions by 2 to execute a multiplication by a scalar.

The usual related representation of a point: P = (x, y) and the representation: (x, \ lambda_ {p}) with \ lambda_ {p} = x + y / x.

From the second representation, it follows y = x (x + \ lambda_ {p}) that only uses one multiplication.

Proceeding like this, to multiply a point by a scale, multiplications are saved by calculating the results with the help of the representation (x, \ lambda_ {p}) and the coordinate of the related representation is determined only at end of calculation

The division by two of a point P is obtained from following way:

Let be calculate [1/2] P from P. Se consider for this the two points of E:

P = (x, y) = (x, x \ (x + λ_ {p}))

Y

Q = (u, v) = (u, u \ (u + \ lambda_ {Q}))

Such that: [2] Q = P

Known multiplication formulas by 2 give

(1) \ lambda_ {Q} = u + v / u

(2) x = \ lambda_ {Q} 2 + \ lambda_ {Q} + α

(3) y = (x + u) \ lambda_ {Q} + x + v

Multiplying (1) by u and carrying the value of v thus obtained at (3), this system becomes:

v = u (u + \ lambda_ {Q})

λ Q 2 + \ lambda_ {Q} = \ alpha + x

y = (x + u) \ lambda_ {Q} + x + u2 + u \ lambda_ {Q} = u2 + x (\ lambda_ {Q} + one)

or, since y = x (x + \ lambda_ {p}):

(i) \ lambda_ {Q} 2 + \ lambda_ {Q} = \ alpha + x

(ii) u2 = x (\ lambda_ {Q} + 1) + y = (\ lambda_ {Q} + \ lambda_ {p} + x + one)

(iii) v = u \ (u + \ lambda_ {Q})

Starting from P = (x, y) = (x, x (x + \ lambda_ {p})) in related coordinates or in representation (x, \ lambda_ {p}), this system of equations determines the two points:

[1/2] P \ in G and [1/2] P + T_ {2} \ in E (F_ {2 ^ {n}}) \ setminus G

that give P by multiplication by 2. The property which follows allows distinguish it

Let E be an elliptic curve of minimum torsion 2, and P \ in E (F_ {2}}) = G x {O, T_ {2}} one of its elements of odd order.

Let Q \ in {[1/2] P, [1/2] P + T_ {2}} and Q_ {1} one of the two points of E such that [2] Q_ {1} = Q.

You have the necessary and sufficient condition:

(a) Q + [1/2] P \ Leftrightarrow Q1 \ in E (F 2 n)

It follows that it is possible to test if Q = [1/2] P applying formulas (i), (ii) and (iii) to Q and verifying if one of the points obtained belongs to E (F 2 n).

This procedure can extend to a curve arbitrary elliptical E (F 2 n) = G x E [2 k]. For this I know formulas (i), (ii) and (iii) apply k times: the 1st time to Q, for, to obtain Q_ {1}, such that [2] Q_ {1} = Q, the ith time to Q_ {i-1} to get a point Q_ {i}, such than [2] Q_ {i} = Q_ {i-1}. Point result Q_ {k} will be of the form

       \ newpage
    

\ left [\ frac {1} {2 ^ {k + i}} \ right] P + T_ {2}

yes, and only if, Q = [1/2] P + T2, and will be of the shape

\ left [\ frac {1} {2 ^ {k + i}} \ right] P + T_2i

with 0 \ leq i \ leq k if, and only if, Q = [1/2] P. There is, therefore, the necessary condition and enough:

Q = [1/2] P \ Leftrightarrow Q_ {k} \ in E (F 2 n)

This procedure is obviously long if k is big.

The relationship (a) shows that one can know if Q = [1/2] P or Q = [1/2] P + T_ {2} observing if the coordinates of Q_ {1}, belong to F_ {2 ^ {}} or a superbody of F_ {n} n. Since Q_ {1} is determined by equations (i), (ii) and (iii), the operations used in the resolution of these equations that are not internal to the body, but they have their result in a superbody of F_ {2}. The only Possible case is the resolution of the 2nd degree equation (i): you also have to calculate a square root to calculate the 1st coordinate of Q_ {1}, but in characteristic 2 the square root It is an operation internal to the body. It has, therefore:

Q = (u, v) = [1/2] P \ Leftrightarrow \ exists \ lambda \ in F_ {2 ^ {n}}: \ lambda2 + \ lambda = \ alpha + or

This necessary and sufficient condition is written, also, since the square root is internal to the body:

Q = (u, v) = [1/2] P \ Leftrightarrow \ exists \ lambda \ in F_ {2 ^ {n}}: \ lambda2 + + lambda = α2 + u2

The previous relationship allows to optimize the algorithm set forth below in the case where the time of Square root calculation is not negligible.

For P \ in G, the 2 solutions of (i) are λ [1/2] P} and λ [1/2] P} + 1, and deduces from (ii) that the 1 as coordinates of the associated points they are u and (u + \ surdx). Therefore, an algorithm can be deduced that allows to calculate [1/2] P as follows:

If F 2 n is a finite body of 2 n elements, E (F_ {2}}) is the subgroup of a curve elliptical E, defined by:

E (F_2n) = \ {(x, y) \ in F_ {2 ^ {n}} \ X \ F_ {2 ^ {n}} \ ly ^ {2} + xy = x ^ {3} + α x 2 + \ beta \} \ cup \ {O \} \ alpha, \ beta \ in F_ {2 ^ n}, \ beta \ neq 0

and E [2k] is the set of points P of said elliptic curve such that P, added 2k times itself gives the neutral element O, with k integer greater than or equal to 1, then, a point P = (x, y) of said elliptic curve gives by the said division by two the point

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

of said elliptic curve, obtained by effecting the following operations illustrated by the organization chart of the figure 3:

? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x

a second value is calculated u_ {0} 2 such that u_ {0} 2 = x (\ lambda_ {0} + 1) + y

If k is worth 1, it is searched if the equation: [lambda] 2 + [lambda] = [alpha] 2 + u_ {2} has solutions in F 2 n,

If so, the abovementioned is calculated Division by two by:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

v_ {0} = u_ {0} \ (u_ {0} + \ lambda_ {0})

Y

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation;

• if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i}, such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u 2 i such that u 2 = u_ {i-1} (\ lambda_ {i} + \ lambda_ {i-1} + u_ {i-1} + 1)

increasing i from i = 1 until the value u_ {k-1} 2 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F2 {n}

If so, the Division by two by:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

v_ {0} = u_ {0} (u_ {0} + \ lambda_ {0})

Y

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation.

If you choose to represent the point

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

of said elliptic curve by (u_ {0}, \ lambda_ {0}) with \ lambda_ {0} = u_ {0} + v_ {0} / u_ {0}, then the algorithm is according to the flow chart of the figure 4, in the what:

? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x

a second value is calculated u 2 0 such that u 0 2 = x (λ 0 + 1) + y

If k is worth 1, it is searched if the equation: λ 2 + λ = α 2 + u 0 {2} has solutions in F 2 n,

If so, the abovementioned is calculated division by two by

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

Y:

\ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0})

? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation;

• if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i} such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u_ {2} such that u_ {2} = u_ {i-1} (\ lambda_ {1} + \ lambda_ {i-1} + u_ {i-1} + one)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F 2 n,

If so, the abovementioned is calculated Division by two by:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

Y

\ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0})

? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation.

If you choose to represent the point P = (x, y) by (x, \ lambda_ {p}) with \ lambda_ {p} = x + y / x given by the cited division by two point

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

of the elliptic curve, then the algorithm is according to the flow chart of figure 5, in the what:

? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x

a second value is calculated u2 {0} such that u_ {2} = x (\ lambda_ {0} + \ lambda_ {p} + x + 1)

If k is worth 1, it is searched if the equation: λ 2 + λ = α 2 + u 0 {2} has solutions in F 2 n,

If so, the abovementioned is calculated Division by two by:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

v_ {0} = u_ {0} (u_ {0} + λ 0)

Y

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

? If not, x is added to the aforementioned second value u 2 0 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation;

• if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i}, such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u 2 i such that u 2 = u_ {i-1} (\ lambda_ {i} + \ lambda_ {i-1} + u_ {i-1} + 1)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F2 {n}

If so, the Division by two by:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

v_ {0} = u_ {0} (u_ {0} + \ lambda_ {0})

Y

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

? If not, x is added to the aforementioned second value u 2 0 and 1 is added to said first value \ lambda_ {0} to calculate the said division by two as in the previous operation.

Finally, if you choose to represent the point P = (x, y) by (x, \ lambdap) with \ lambda_ {p} = x + y / x giving the cited division by two point

\ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0})

of the elliptic curve represented by (u_ {0}, \ lambda_ {0}) with \ lambda_ {0} = u_ {0} + v_ {0} / u_ {0}, then the algorithm is according to the flow chart of the figure 6, in the what:

? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x

a second value is calculated u_ {0} 2 such that u_ {0} 2 = x (\ lambda_ {0} + \ lambda_ {p} + x + 1)

If k is worth 1, it is searched if the equation: λ 2 + λ = α 2 + u 0 {2} has solutions in F 2 n,

if so, the said division is calculated by two for:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

Y

\ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda 0)

? If not, x is added to the aforementioned second value u 2 0 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation;

• if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i}, such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u 2 i such that u 2 = u_ {i-1} (\ lambda_ {i} + \ lambda_ {i-1} + u_ {i-1} + 1)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F2 {n}

If so, the Division by two by:

u_ {0} = \ sqrt {u_ {0} {} ^ {2}}

Y:

\ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda 0)

? If not, x is added to the aforementioned second value u_ {0} and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation.

It will now be described how to effect quickly the proof, the resolution of the second degree equation, and the calculation of the square root in the division algorithm of a point by 2. The two cases will be considered on a normal basis and polynomial

The results on a normal basis are known. F_ {2 ^ n} can be considered as a vector space of n dimensions in F_ {2}. On a normal basis, an element of the body It is represented by:

\hskip4cm

x_{i}\in\{0,1\}x = \ sum \ limits_ {i = 0} ^ {n-1} x_ {i} \ \ beta ^ {2 ^ {}}

 \ hskip4cm 

x_ {i} \ in \ {0,1 \}

where \ beta \ in F_ {2}, is chosen such that: {?,? 2, ...,? 2n-1} is a base F_ {n}. On a normal basis, the square root is calculates by a left circular displacement, and the elevation at square by a right circular displacement. The times of Corresponding calculations are therefore despicable.

If the second degree equation: λ2 + \ lambda = x has solutions in F_ {2}, a solution comes given, then, by:

\hskip0,5cm

con: \lambda_{i} = \sum\limits_{k=1}^{i} x_{i}

\hskip1cm

con \ 1\leq i \leq n - 1\ lambda = \ sum \ limits_ {i = 1} ^ {n-1} \ lambda_ {i} \ \ beta ^ {2 ^ {}}

 \ hskip0,5cm 

with: \ lambda_ {i} = \ sum \ limits_ {k = 1} ^ {i} x_ {i}

 \ hskip1cm 

with \ 1 \ leq i \ leq n - 1

The calculation time of λ is negligible versus the calculation time of a multiplication or an investment inside the body As the calculation time of a solution of the second degree equation is negligible, the test as follows: a candidate is calculated? starting from x and testing if λ 2 + λ = x. If this this is not the case, the equation has no solution in F_ {2}.

On a polynomial basis, the representation:

x = \ sum \ limits_ {i = 0} ^ {n-1} x_ {i} \ Ti

with x_ {i} \ in {0,1}. The square root of x can be calculated by storing the element \ surdT if observed what:

- in a characteristic body 2, the root square is a morphism of the body,

\ sqrt {\ sum_ {i \ par} x_ {i} T ^} = \ sum_ {i \ par} x_ {i} T ^ {\ tfrac {i} {2}}

Regrouping in x the odd and even powers of T and taking the square root, you get to:

\ sqrt {x} = \ sum \ limits_ {i \ odd} x_ {i} T ^ {\ tfrac {i} {2}} + \ sqrt {T} \ sum \ limits_ {i \ odd} x_ {i} T ^ {\ tfrac {i-1} {2}}

so, to calculate a square root, just "reduce" two vectors in half, and then run one multiplication of a precalculated value by an element of length n / 2 For this reason, the calculation time of a square root in a polynomial base is equivalent to half the calculation time of a multiplication within Body.

For testing and solving the equation of second grade, F_ {2} is considered as a vector space of n dimensions in F_ {2}. The F application defined by:

F: F_ {2 ^ {n}} \ rightarrow F_ {n}

\ lambda \ rightarrow \ lambda2 + λ

it is then a linear core operator {0,1}.

For a given x, the equation λ2 + λ = x has its solutions in F_ {2 ^ n} if, and only if, the vector x is the image of F. Im (F) is a subspace of F_2n of n-1 dimensions. For a given base of F_ {n}} and the corresponding scalar product, there is a single orthogonal nontrivial vector to all vectors of IM f). Let w be this vector. It has:

\ exists \ lambda \ in F_ {2 ^ {n}}: λ 2 + λ = x \ Leftrightarrow x. w = 0

Thus, the execution of the test can be done adding the components of x to which they correspond w components equal to 1. The runtime of this test It is negligible.

For the resolution of the 2nd degree equation: F (λ) = λ 2 + λ = x on a base polynomial, a simple and direct method that imposes the storage of a matrix of n x n. For that, an operator is sought linear G such that:

\ forall x \ in Im (F): F (G (x)) = (G (x)) 2 + G (x) = x

Let \ gamma \ inF_ {2} be a vector such that \ gamma \ notinIm (F) and G is defined by:

10

Given the

x = \ sum_ {i = 1} ^ {n - 1} x_ {1} F (Ti) \ in IM f)

then G (x) is a solution to the equation 2nd grade An implementation consists of precalculating the matrix which represents G at the base {1, T, ....., T n-1). In characteristic 2, the multiplication of a matrix by a vector is reduced to the addition of the columns of the matrix to which a vector component corresponds equal to 1. It follows that this method of solving an equation 2nd grade consumes on average n / 2 additions within the body F_2n.

The application of the principles exposed to scalar multiplication.

Let P \ in E (F_ {2 ^ {n}}) be an order point r odd, c a random integer and m the integer part of log_ {2} (r). The product [c] P of a point is calculated by a scalar using the application of division of a point by 2.

It is shown that:

For any integer c, there is a number rational form:

\hskip0,5cm

c_{i} = \in\{0,1\}\ sum \ limits_ {i = 0} ^ {m} \ frac {c_ {i}} {2 ^ {}}

 \ hskip0,5cm 

c_ {i} = \ in \ {0,1 \}

such what:

\hskip0,5cm

(mod \ r)C = \ sum \ limits_ {i = 0} ^ {m} \ frac {c_ {i}} {2 ^ {}}

 \ hskip0,5cm 

(mod \ r)

Let <P> be the cyclic group generated by P. How to have the ring isomorphism:

P = Z / rZ

k [P] \ rightarrow k

Scalar multiplication can be calculated by:

[c] P = \ sum \ limits_ {i = 0} ^ {m} \ left [\ frac {c_ {i}} {2 ^ {i}} \ right] P

using divisions by 2 and additions. The well-known doubling-adding algorithm It can be used for these calculations. For this it is enough to replace in the doubling algorithms by divisions by 2. You have to perform log_ {2} (r) divisions by 2 and, on average, 1/2 log_ {2} (r) additions. There are improvements to the algorithm of bending-addition that only require 1/3 log_ {2} (r) additions as half.

Therefore, one cited is obtained scalar multiplication using a division by two such as the defined above by the following operations:

-

if the aforementioned scalar of the multiplication is indicated by S_ {i}, m + 1 values are chosen So ... Sm \ in {0,1} to define S by:

S = \ sum \ limits_ {i = 0} ^ {m} \ S_ {i} \ left (\ frac {r + 1} {2} \ right) ^ {i}

-

r being the order odd cited above and m the unique integer between log_ {2} (r) - 1 and log_ {2} (r).

-

the scalar multiplication [S] P of a point P of the aforementioned elliptic curve by the S scalar by application of an algorithm consisting of determining the succession of points (Q_ {m + 1}, Q_ {m} ..., Q_ {i} ... Q_ {o}) of the said elliptical curve E such what

Q_ {m + 1} = O (element neutral)

\hskip0,5cm

con \ 0 \leq i \leq mQ_ {i} = [S_ {i}] P + \ left [{\ frac {1} {2}} \ right] Q_ {i + 1}

 \ hskip0,5cm 

with \ 0 \ leq i \ leq m

-

the calculation of last point Q_ {o} of the aforementioned sequence gives the result [S] P of the aforementioned scalar multiplication.

To add the initial P point to a result intermediate

Q = \ left [\ frac {1} {2} \ right] Q_ {i}

the following algorithm is used, which is the traditional algorithm, slightly modified:

Input: P = (x, y) in related coordinates and Q = (u, u (u + \ lambda_ {Q})) represented by (u, \ lambda_ {Q})

Output: P + Q = (s, t) in related coordinates

Algorithm

1. It is calculated: \ lambda = (y + u (u + \ lambda_ {Q})) / (x + u)

2. It is calculated: s = \ lambda2 + \ lambda + a + x + u

3. It is calculated: t = (s + x) \ lambda + s + Y

4. Result: (s, t)

This algorithm uses 1 inversion, 3 multiplications, and 1 square root.

The time gain obtained by replacing the multiplication operations by 2 by divisions by 2 is important. In related coordinates, the multiplication by 2 and the addition require, both: an investment, two multiplications, and one square root. If the scalar multiplication by a scalar It is represented by a bit vector of length m and k non-zero components, operations for multiplication scalar demand:

operation bending and addition Division by 2 and addition investments m + k k multiplications 2m + 2k m + 3k squares m + k k resolution λ 2 + λ = a + x 0 m estate square 0 m tests 0 m

       \ newpage
    

Thus, using division by 2, you save m investments, m-k multiplications, and m squares, to coast of m 2nd grade resolutions, m square roots and m tests.

On the polynomial basis, an improvement in Runtime close to 50%.

On a normal basis, the calculation time of the square root of the test and the resolution of the equation of 2nd grade negligible against the calculation time of a multiplication or an investment. Assuming, in addition, that time Calculation of an investment is equivalent to the calculation time of 3 multiplications, you get an improvement in the runtime 55%

Figure 2 schematically illustrates a possible application of the algorithms described above, implemented between two entities A and B that exchange information through an unprotected communication channel. The quoted communication channel, can be summarized here in simple electrical connections established between the two entities the Time of a transaction. This one can also comprise a network of telecommunication, hertzian or optical. In this case, entity A This is a microcircuit card and entity B is a server. Once placed in relation to one another by the aforementioned channel of communication, the two entities will apply a protocol of Construction of a common key. To do this:

-

entity A has a secret key to

-

entity B has a secret key b

They have to make a secret code x only known to them, from a public key constituted by a point P of odd order r of an elliptic curve E chosen and not supersingular.

The protocol implemented is of the type of Diffie-Hellmann replacing the usual "multiplications by two", called doubling point, for the operation called "division by two", of according to the invention described above.

To do this, the algorithm is the next:

-

the first entity (for example A) calculate the scalar multiplication [a] P and send the result point to the second entity,

-

the second entity (B) calculate the scalar multiplication [b] P and send the point result to the first entity,

-

the two entities calculate, respectively, a common point (C) = (x, y) of that elliptic curve (E) performing, respectively, the multiplications scalars [a] ([b] P) and [b] ([a] P), both equal to [a, b] P,

-

the two entities choose as common key the x coordinate of the said common point (C) obtained by the aforementioned scalar multiplication [a, b] P, performing at least one of the scalar multiplications precedents, and preferably all, with the help of divisions per do predefined.

By way of a more precise example, Figure 7 represents a server B linked to a communication network 1 by intermediate of a communication interface 2, for example of the type modem. Similarly, a calculation station 3 is connected to the network 1 through a communication interface 4. Station 3 is equipped with a microcircuit card reader 5, in which microcircuit card A is inserted.

Live memory 6 of server B contains a program 7 capable of executing cryptographic calculations in curves elliptical and, in particular, the product of a point by a scalar and the division of a point by 2.

Card A comprises a central unit 11, a living memory called "RAM" 8, a dead memory called "ROM" 9 and a rewritable memory called "EEPROM" 10. One of memories 9 or 10 contains a program 12 capable of run cryptographic calculations on elliptical curves and, in particular, the product of a point by a scalar and the division of one point for 2.

Both programs 7 and 12 have a reference common consisting of the same elliptic curve (E) and the same point P = (x_ {0}, y_ {0}) of (E).

When A wishes to construct a common secret key in parallel with B to protect a dialogue with B, he chooses a scalar a and sends B the product Q = [a, b] P = (x_ {1}, y_ {1}). In response to this shipment, B chooses a scalar b and returns to A the product R = [b] P = (x_ {2}, y_ {2}).

A calculates, then, the product [a] R = [ab] P = (x, y), while B calculates the product [b] Q = [ab] P = (x, y), and A and B adopt x as the key common secret

       \ newpage
    

These operations can be represented by the table indicated below. Those made in the server B are indicated in the right column, while that those made on card A are indicated on the left column, the horizontal arrows symbolize the information transfers through the network 1.

one

Another possible application that brings the invention is likely to be implemented between the two entities A and B of Figure 7. This is a protocol for signing a message M transmitted between A and B through channel no protected, that is, network 1. The purpose of this protocol, known in its main lines, it is to provide the certainty that the message received by one of the entities has been issued well by that with which it corresponds.

To do this, the issuing entity (for example A) has two permanent keys, one secret a and one public Q = [a] P, where P is a point of an elliptic curve (E), where P and (E) are known and agreed by A and B. Another public key is constituted by the point P of odd order r of the elliptic curve E chosen, not supersingular. The operations put into play imply divisions by two, in the sense defined above.

According to a possible example:

-

the first entity (A) that has the aforementioned permanent key pair builds a pair of single use keys, one (g) being chosen arbitrarily and the other, [g] P resulting from a scalar multiplication of the aforementioned key (g) arbitrarily chosen by public point P of said elliptic curve, indicating the coordinates of this key ([g] P) by (x, y), with 2 \ leq g \ leq r-2,

-

the first entity (A) convert the polynomial x of the cited usage key unique [g] P = (x, y) in an integer i whose binary value is represented by the sequence of the binary coefficients of cited polynomial x,

-

the first mentioned entity (A) calculates a signature (c, d) of the message (M) of the mode next:

c = i module r

d = g <-1> (M + ac) module r,

-

the first mentioned entity sends said message (M) and said signature (c, d) to the second entity; at reception

-

the second cited entity (B) verifies whether the elements of the said firm (c, d) each belong to the interval [1, r-1],

-

if not, declares the signature invalid and stops,

-

if so, the said second entity (B) calculates three parameters:

h = d <-1> module r

h_ {1} = Mh module r

h_ {2} = ch module r

-

the second cited entity calculates a point T of said elliptic curve by the sum of the scalar multiplications of points P and Q by both Last parameters cited:

T = [h_ {1}] P + [h_ {2}] Q

if the resulting point T is the neutral element, the said second entity declares the signature invalid and stop

if not, considering the point T of coordinates x ' e y ': T = (x', y '),

the said second entity (B) converts the polynomial x 'of this point in an integer i' whose binary value is represented by the sequence of the binary coefficients of cited polynomial x '

-

the second cited entity (B) calculates c '= i' module r, and

-

verify that c '= c to validate the aforementioned signature or otherwise invalidate it, performing at least one said multiplication operation scale, and preferably all, with the help of divisions by two predefined.

These operations can be represented by the table indicated below, where the operations carried out on server B they are indicated in the right column while the operations performed on card A are indicated in the left column, symbolizing the arrow between the two columns the transfers of information through of the network 1.

two

Claims (10)

1. Cryptography procedure implemented between two entities that exchange information through an unprotected communication channel, of the type that includes, at least, an operational phase consisting of multiplying an odd point of order of a non-supersingular elliptic curve by an integer, in related coordinates, characterized in that, in order to exchange information through the unprotected communication channel, an operational phase of this type includes additions and divisions by two points of said elliptic curve, where the addition of points is a known operation, and the division by two of a point P is defined as the single point D of odd order such that [2] D = P, a point of this type being indicated by: \ left [\ frac {1} {2} \ right] P, and the division operation by 2, by: \ left [\ frac {1} {2} \ right] 2. Procedure according to claim 1, in which: F_2n is a finite body of 2n elements, E (F 2 n) is the subgroup of an elliptical curve E, defined by: E (F_2n) = {(x, y) \ in F_ {2} x X F_ {2} n and ly2 + xy = x3 + αx2 + \ beta} \ cup {O} \ alpha, \ beta \ in F_ {2}, \ beta \ neq 0 and E [2k] is the set of points P of said elliptic curve such that P, added 2k times to itself, gives the neutral element O, with an integer greater than or equal to 1, characterized in that a point P = (x, y) of the said elliptical curve gives the point divided by two the point \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) of said elliptic curve, obtained by effecting the operations following: ? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x a second value is calculated u_ {0} 2 such that u_ {0} 2 = x (\ lambda_ {0} + 1) + y If k is worth 1, it is searched if the equation: [lambda] 2 + [lambda] = [alpha] 2 + u_ {2} has solutions in F 2 n, If so, the abovementioned is calculated Division by two by: u_ {0} = \ sqrt {u_ {0} {} ^ {2}} v = u_ {0} \ (u_ {0} + \ lambda_ {0}) Y \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) ? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation. • if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i} such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u_ {1} 2 such that u_ {2} = u_ {i-1} (\ lambda_ {1} + \ lambda_ {i-1} + u_ {i-1} + one)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F 2 n, If so, the abovementioned is calculated division by two by u_ {0} = \ sqrt {u_ {0} {} ^ {2}} v = u_ {0} (u_ {0} + \ lambda_ {0}) Y \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) if not, x is added to the second one value u_ {2} {2} and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the operation preceding. 3. Procedure according to claim 1, in which: F 2 is a finite body of 2 n elements, E (F_ {2}}) is the subgroup of a curve elliptical E, defined by: E (F_2n) = {(x, y) \ in F_ {2} n X F_ {2 ^ {n}} ly2 + xy = x3 + αx2 + \ beta} \ cup {O} \ alpha, \ beta \ in F_ {2}, \ beta \ neq 0 and E [2k] is the set of points P of said elliptic curve such that P, added 2k times to itself, gives the neutral element O, with an integer greater than or equal to 1, characterized in that a point P = (x, y) of the said elliptical curve gives the point divided by two the point \ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0}) with \ lambda_ {0} = u_ {0} + v_ {0} / u_ {0}, obtained by performing the operations following: ? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x a second value is calculated u_ {0} 2 such that u_ {0} 2 = x (\ lambda_ {0} + 1) + y If k is worth 1, it is searched if the equation: [lambda] 2 + [lambda] = [alpha] 2 + u_ {2} has solutions in F 2 n, If so, the abovementioned is calculated Division by two by: u_ {0} = \ sqrt {u_ {0} {} ^ {2}} Y \ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0}) if not, x is added to the second one value u_ {2} {2} and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the  operation preceding: • if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {1}, such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u 2 i such that u 2 = u_ {i-1} (\ lambda_ {i} + \ lambda_ {i-1} + u_ {i-1} + 1)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 has solutions in F_ {n} If so, the Division by two by: u_ {0} = \ sqrt {u_ {0} ^ {2}}

 \ 

Y

 \ 

\ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0}) ? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in The preceding operation. 4. Procedure according to claim 1, in which: F_2n is a finite body of 2n elements, E (F 2 n) is the subgroup of an elliptical curve E, defined by: E (F_2n) = {(x, y)} \ in F_ {2 ^ {}} X F_ {2 ^ n} ly2 + xy = x3 + αx2 + \ beta} \ cup {O} \ alpha, \ beta \ in F_ {2}, \ beta \ neq 0 and E [2k] is the set of points P of said elliptic curve such that P, added 2k times to itself, gives the neutral element O, with an integer greater than or equal to 1, characterized in that a point P = (x, y) of the said elliptic curve represented by (x, λ_ {p}) with λ_ {p} = x + y / x gives the point by said division by two the point \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) of the aforementioned elliptical curve obtained by performing the operations following: ? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x a second value is calculated u_ {0} 2 such that u_ {0} 2 = x (\ lambda_ {0} + \ lambda_ {p} + x + 1) If k is worth 1, it is searched if the equation: [lambda] 2 + [lambda] = [alpha] 2 + u_ {2} has solutions in F 2 n, If so, the abovementioned is calculated Division by two by: u_ {0} = \ sqrt {u_ {0} {} ^ {2}} v_ {0} = u_ {0} (u_ {0} + \ lambda_ {0}) Y \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) ? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation; • if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i}, such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {1-1}

calculate the value later u 2 i such that u 2 = u_ {i-1} (\ lambda_ {i} + \ lambda_ {i-1} + u_ {i-1} + 1)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F2 {n} If so, the Division by two by: u_ {0} = \ sqrt {u_ {0} {} ^ {2}} v_ {0} = u_ {0} (u_ {0} + \ lambda_ {0}) Y \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) ? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation. 5. Procedure according to claim 1, in which: F 2 is a finite body of 2 n elements, E (F_ {2}}) is the subgroup of a curve elliptical E, defined by: E (F_2n) = {(x, y)} \ in F_ {2 ^ {}} X F_ {2 ^ n} ly2 + xy = x3 + αx2 + \ beta} \ cup {O} \ alpha, \ beta \ in F_ {2}, \ beta \ neq 0 and E [2k] is the set of points P of said elliptic curve such that P, added 2k times to itself, gives the neutral element O, with an integer greater than or equal to 1, characterized in that a point P = (x, y) of the said elliptic curve represented by (x, λ_ {p}) with λ_ {p} = x + y / x gives the point by said division by two the point \ left [\ frac {1} {2} \ right] P = (u_ {0}, v_ {0}) of said elliptical curve represented by (u_ {0}, \ lambda_ {0}) with \ lambda_ {0} = u_ {0} + v_ {0} / u_ {0} obtained by performing the operations following: ? a first value is sought \ lambda_ {0} such that \ lambda_ {0} 2 + \ lambda_ {0} = α + x a second value is calculated u_ {0} 2 such that u_ {0} 2 = x (\ lambda_ {0} + \ lambda_ {p} + x +1) If k is worth 1, it is searched if the equation: [lambda] 2 + [lambda] = [alpha] 2 + u_ {2} has solutions in F 2 n, If so, the abovementioned is calculated Division by two by: u_ {0} = \ sqrt {u_ {0} {} ^ {2}} Y \ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0}) ? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation: • if k is greater than 1, a iterative calculation consisting of:

find a value \ lambda_ {i}, such that \ lambda_ {i} 2 + \ lambda_ {i} = α + u_ {i-1}

calculate the value later u 2 i such that u 2 = u_ {i-1} (\ lambda_ {i} + \ lambda_ {i-1} + u_ {i-1} + 1)

increasing i from i = 1 until the value u 2 k-1 is obtained

? is sought if the equation \ lambda2 + λ = α 2 + u 2 k-1 it has solutions in F2 {n} If so, the Division by two by: u_ {0} = \ sqrt {u_ {0} {} ^ {2}} Y

         \ newpage
      

\ left [\ frac {1} {2} \ right] P = (u_ {0}, \ lambda_ {0}) ? If not, x is added to the aforementioned second value u_ {2} 2 and 1 is added to said first value \ lambda_ {0}, to calculate the said division by two as in the previous operation. 6. Method according to one of the preceding claims, characterized in that it is a protocol for the construction of a common key from two secret keys that belong, respectively, to the two said entities and a public key consisting of a point P of odd order r of an elliptic curve E chosen and not supersingular. 7. Method according to claim 6, characterized in that, in a manner known per se, a and b being the secret keys of a first and a second entity, respectively:

-

the first entity calculate the scalar multiplication [a] P and send the point result to the second entity

-

the second entity calculate the scalar multiplication [b] P and send the point result to the first entity

-

the two entities calculate, respectively, a common point C = (x, y) of that elliptic curve (E) performing, respectively, the multiplications scalars [a] ([b] P) and [b] ([a] P), both equal to [a.b] P,

-

the two entities choose as common key the coordinate (x) of the said common point (C) obtained by the aforementioned scalar multiplication [a.b] P, at least one of the preceding multiplications being carried out and, preferably, all, with the help of divisions by two predefined.

Method according to one of claims 1 to 5, characterized in that it is a signing protocol between two entities based on a pair of permanent keys belonging to one of the entities, one secret (a) and the other public (Q), resulting from the scalar multiplication of the secret key (a) by another public key consisting of an odd order point (P) of a chosen elliptic curve (E) and not supersingular. 9. Method according to claim 8, characterized by the following operations:

-

the first entity (A) that has the aforementioned permanent key pair builds a pair of single use keys, choosing one (g) arbitrarily, and the other, [g] P resulting from a scalar multiplication of the aforementioned key (g) arbitrarily chosen by public point P of said elliptic curve, indicating the coordinates of this key ([g] P) by (x, y), with 2 \ leq g \ leq r-2,

-

the first entity (A) convert the polynomial x of the cited usage key unique [g] P = (x, y) in an integer i whose binary value is represented by the sequence of the binary coefficients of cited polynomial x,

-

the first mentioned entity (A) calculates a signature (c, d) of the message (M) of the mode next:

c = i module r d = g <-1> (M + ac) module r,

-

the first mentioned entity sends said message (M) and said signature (c, d) to the second entity; at reception

-

the second cited entity (B) verifies whether the elements of the said firm (c, d) each belong to the interval [1, r-1],

-

if not, declares the signature invalid and stops,

-

if so, the said second entity (B) calculates three parameters:

h = d <-1> module r h_ {1} = Mh module r h_ {2} = ch module r

-

the second cited entity calculates a point T of said elliptic curve by the sum of the scalar multiplications of points P and Q by both Last parameters cited:

T = [h_ {1}] P + [h_ {2}] Q

   if the resulting point T is the neutral element, the said second entity declares the signature no valid and stops

if not, considering point T of coordinates x 'e y': T = (x ', y'),

-

the second cited entity (B) converts the polynomial x 'of this point into an integer i' whose binary value is represented by the sequence of binary coefficients of the aforementioned polynomial x '

-

the second cited entity (B) calculates c '= i' module r, and

-

verify that c '= c to validate the aforementioned signature or otherwise invalidate it, performing at least one said multiplication operation scale, and preferably all, with the help of divisions by Two predefined.

10. Method according to claims 7 or 9, characterized in that said scalar multiplication using divisions by two is obtained by the following operations:

-

if the aforementioned scalar of the multiplication is indicated by S_ {i}, m + 1 values are chosen So ... Sm \ in {0,1} to define S by:

S = \ sum \ limits_ {i = 1} ^ {m} Yes} \ left (\ frac {r + 1} {2} \ right) ^ {i}

-

r being the order odd cited above and m the unique integer between log_ {2} (r) - 1 and log_ {2} (r).

the scalar multiplication is calculated [S] P of a point P of said elliptic curve by the scalar S, by application of an algorithm consisting in determining the sequence of points (Q_ {m + 1}, Q_ {m} ..., Q_ {i} ... Q_ {o}) of the mentioned curve  elliptical E, such that Q_ {m + 1} = O \ (element \ neutral) Q_ {i} = [S_ {i}] P + \ left [\ frac {1} {2} \ right] Q_ {i + 1} with 0 \ leq l \ leq m giving the calculation of the last point Q_ {o} of the said succession, the result [S] P of the said multiplication climb.